General
-
Target
locker.exe
-
Size
96KB
-
Sample
240722-ggp3ms1gln
-
MD5
f2968d0ef2c95f2a2dfb8740b6a2df3f
-
SHA1
57db6387ab42a51e185bbbf7d54bdfef2541b59c
-
SHA256
25e41d0a73121a4314df3ce977d182739f592d168999cfa6cd0b8eb69c0e6ebe
-
SHA512
df35537fc5792cfae0c268c0b8ba49afb62a0672cd83bfe2ab899b85079423b1aa14d2a25b0c72f3b884315e35bbb7b53543780f212bdb67b105a2953a667d09
-
SSDEEP
768:kCq6+Ae2btbSbEdAp5pAFBkmT2flfuFbMg:HT+ADtbSbeupmymT2flfu9Mg
Static task
static1
Behavioral task
behavioral1
Sample
locker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
locker.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
locker.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
locker.exe
Resource
win11-20240709-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Recovery.txt
https://getsession.org
Targets
-
-
Target
locker.exe
-
Size
96KB
-
MD5
f2968d0ef2c95f2a2dfb8740b6a2df3f
-
SHA1
57db6387ab42a51e185bbbf7d54bdfef2541b59c
-
SHA256
25e41d0a73121a4314df3ce977d182739f592d168999cfa6cd0b8eb69c0e6ebe
-
SHA512
df35537fc5792cfae0c268c0b8ba49afb62a0672cd83bfe2ab899b85079423b1aa14d2a25b0c72f3b884315e35bbb7b53543780f212bdb67b105a2953a667d09
-
SSDEEP
768:kCq6+Ae2btbSbEdAp5pAFBkmT2flfuFbMg:HT+ADtbSbeupmymT2flfu9Mg
Score10/10-
Renames multiple (169) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Sets desktop wallpaper using registry
-